I have some events, that are indexed with strange dates...
17:56:58,442: htsxml2|c6d1956a-d611-47a5-97df-df0d31e1dbc7|32885|790667|483520|1|B|default|OK|65|3391 17:56:56,546: htsxml2|86bbb572-360d-4c12-8a18-0bd08ce0d7c0|17116|108051|130889|110|B|default|ERROR|-1|-1
Is there a way I can force the date to apply to the events contained in an specific file?
If you use a filename that has a date in it, that date will be used (if there are no timestamps on your events).
For example, if you rename "dispo.log.P" to "dispo.20101020.log.P" those events should be indexed as occurring on Oct 20, 2010.
Hmm. Rather than trying one really complex regex with lots of logic in it, did you try having 3 dead-simple regexes, with appropriate literals in it to match on like |B| vs |P| ? Sourcetypes can easily have more than one regex in them and 3 super-simple ones might perform better than one crazy-complicated one.
As a supplement to both answers provided, the method to accomplish either is to use datetime.xml. In the former, you can setup 3 different rules to use, in the latter, you can tell Splunk to get the date from the filename and the time from the event.